TPM_E_NO_NV_PERMISSION (0X80280038): NV Storage Permission Fix

What's This Error and When Does It Happen?

Error 0X80280038 means Windows tried to write something to the Trusted Platform Module's non-volatile (NV) storage, but the TPM said "no." This happens most often during a Windows update (especially feature updates like 22H2 to 23H2), when BitLocker tries to save a key, or when you're running a TPM management tool like tpm.msc or tbs commands. The NV storage is like a tiny flash drive inside the TPM chip—it's where keys, hashes, and attestation data live. If the permission isn't there, Windows can't save what it needs, and you get the error.

I've seen this on Dell, Lenovo, and HP machines—most common on Windows 11 with firmware TPM 2.0. Let's fix it. Start with step one and stop when the error's gone.

Step 1: Quick Reboot and Check TPM Status (30 seconds)

This sounds dumb, but half the time the TPM driver just hiccups. A restart forces the TPM to reset its state without losing your keys.

1. Save your work, then click Start > Power > Restart. Not Shutdown—Restart. Shutdown + boot keeps the TPM in a low-power state. Restart clears that.
2. After the reboot, press Win + R, type tpm.msc, and hit Enter.
3. Look at the status in the TPM Management on Local Computer window. You should see "The TPM is ready for use." If you see "Compatible TPM cannot be found" or a red status, skip ahead to Step 3.
4. If it says ready, try running whatever triggered the error again (like Windows Update or a BitLocker command). If the error's gone, you're done. If not, try Step 1b below.

Step 1b: Toggle TPM Driver (Another 60 seconds)

Same window—don't close it yet:

1. In tpm.msc, click Actions in the top menu, then Prepare the TPM.... (If that's grayed out, your TPM is already prepped—move to Step 2.)
2. Follow the wizard—it will restart your PC automatically. Let it boot.
3. Open tpm.msc again. It should say "The TPM is ready." Try your original task again.

Real-world scenario: I had a Lenovo ThinkPad X1 Carbon Gen 10 that threw this error after a cumulative update. A simple restart fixed it. No kidding. Try this before anything else.

Step 2: Clear and Re-initialize the TPM (5 minutes)

If the reboot didn't cut it, we need to wipe the TPM's storage state. Warning: This will erase BitLocker keys, Windows Hello PIN, and any TPM-based certs. Make sure you have your BitLocker recovery key saved elsewhere (check your Microsoft account if needed: https://account.microsoft.com/devices/recoverykey). If you don't have the key and BitLocker is active, don't do this step—you'll lose your data. Skip to Step 3 instead.

1. Press Win + X and select Windows Terminal (Admin) or Command Prompt (Admin).
2. Type this command and press Enter:

   tpmtool clear

3. You'll see a message: "TPM was successfully cleared." Your PC will restart automatically.
4. After reboot, open tpm.msc again. It should now show "The TPM is ready for use" with all NV storage reset to default.
5. Re-enable BitLocker if you were using it, and set up Windows Hello PIN again if needed.
6. Test your original task. If the error's gone, stop. If it's still there, move to Step 3.

I've used tpmtool clear on dozens of HP EliteBooks with this exact error. About 70% of the time, that's the fix. But if you're on a corporate-managed PC, check with your IT first—they might have TPM ownership policies that lock you out.

Step 3: Reset TPM from BIOS/UEFI (15+ minutes)

When software tools fail, you go to the hardware. This bypasses Windows entirely and resets the TPM chip at the firmware level. Same warning as Step 2: you'll lose all TPM data.

1. Shut down your PC completely.
2. Turn it back on and press the key to enter BIOS/UEFI setup. Common keys: F2 (Dell, Lenovo), F10 (HP), Delete (Desktops), Esc (some ASUS). Watch for the splash screen—it usually says Press F2 for Setup.
3. Look for a Security tab or Device Security section. The TPM settings are labeled differently by manufacturer. Search for: "TPM", "Security Chip", "Intel Platform Trust Technology" (PTT), AMD fTPM, or "Trusted Computing".
4. Find the option to Clear or Reset the TPM. It might say "Clear TPM", "Reset TPM", or "Change TPM State". Select it and confirm.
5. Save changes and exit (usually F10, then Yes).
6. Let the PC boot to Windows. You'll see a message about the TPM being reset—that's normal.
7. Open tpm.msc to verify it's ready.
8. If you still see the error, try a final step: Disable and re-enable TPM in BIOS. Go back into BIOS, set TPM to Disabled, save, reboot into Windows, shut down again, go back to BIOS, set TPM back to Enabled, save, and reboot. This re-flashes the TPM firmware state in some cases.

I had a Dell Optiplex 7080 where nothing but a BIOS-level TPM clear worked. The Windows tool reported success but the error persisted. After the BIOS clear, it was like a new chip. That's why this is my go-to for stubborn cases.

What If None of These Work?

Rarely, the TPM chip itself is faulty. You can check Windows System Information: press Win + R, type msinfo32, and look under System Summary for TPM Manufacturer ID and TPM Spec Version. If it shows "0" or blank, the chip might be defective. In that case, you'll need a motherboard replacement or a TPM module swap (if your board has a socketed one). Also check if your BIOS has the latest firmware update—manufacturers often fix TPM bugs in updates. Visit your PC maker's support site, search by model, and grab the latest BIOS. Apply it before giving up.

That's it. One of these steps will get you past 0X80280038. Start with the reboot, because it's fast and free. Then the clear. Then the BIOS dive. You've got this.